@wpelevator/wp-release 0.14.0 → 0.16.0

package/dist/commands/package-source.js

@@ -0,0 +1,101 @@
+import { basename, resolve } from 'node:path';
+import { ValidationError } from "../errors.js";
+import { resolveFileSelection } from "../file-selection.js";
+import { getPackageFiles } from "../package-deploy.js";
+import { readPackageMeta } from "../package-meta.js";
+import { checkDirectory, getFileSelectionInput, getSourceDirArg, } from "./args.js";
+import { getBoolean, getString, getStrings } from "./command.js";
+/** Options of a source directory and its files, which --package takes from the config. */
+const SOURCE_FLAGS = [
+    'source-dir',
+    'distignore',
+    'no-distignore',
+    'exclude',
+    'exclude-gitattributes',
+];
+/**
+ * Get the configured package to release, failing for the options that set the
+ * source directory and the files instead.
+ *
+ * @param  values      Parsed CLI values.
+ * @param  positionals Positional arguments.
+ * @return The package identifier or path, or undefined without --package.
+ * @throws {ValidationError} For an empty --package, or --package with a source directory or file selection option.
+ */
+export function getPackageArg(values, positionals) {
+    const name = getString(values, 'package')?.trim();
+    const conflicts = SOURCE_FLAGS.filter((flag) => undefined !== getString(values, flag) ||
+        getBoolean(values, flag) ||
+        getStrings(values, flag).length);
+    if ('' === name) {
+        throw new ValidationError('--package <name> must not be empty.');
+    }
+    if (name && (positionals.length || conflicts.length)) {
+        throw new ValidationError(`--package takes the directory and files of the package from the config, so it can't be combined with ${positionals.length
+            ? 'a source directory'
+            : conflicts.map((flag) => `--${flag}`).join(', ')}.`);
+    }
+    return name;
+}
+/**
+ * Describe the files of a directory with the slug and the version from the
+ * options, or from the plugin or theme headers.
+ *
+ * @param values    Parsed CLI values.
+ * @param sourceDir Directory to release.
+ * @param selection File selection.
+ * @param slug      Default slug.
+ * @return Source directory, file selection, slug, version and type.
+ */
+async function describeSource(values, sourceDir, selection, slug) {
+    const name = getString(values, 'slug') ?? slug;
+    const meta = await readPackageMeta({ dir: sourceDir, slug: name });
+    return {
+        sourceDir,
+        selection,
+        slug: name,
+        version: getString(values, 'version') ?? meta?.version ?? null,
+        ...(meta ? { type: meta.type } : {}),
+    };
+}
+/**
+ * Get the files of a source directory from the CLI options.
+ *
+ * @param values      Parsed CLI values.
+ * @param positionals Positional arguments.
+ * @param cwd         Working directory.
+ * @return Source directory, file selection, slug and version.
+ */
+export async function getDirectorySource(values, positionals, cwd) {
+    const sourceDir = resolve(cwd, getSourceDirArg(values, positionals));
+    await checkDirectory(sourceDir);
+    return describeSource(values, sourceDir, resolveFileSelection({
+        cwd,
+        sourceDir,
+        ...getFileSelectionInput(values),
+    }), basename(cwd));
+}
+/**
+ * Get the directory of a configured package with the files config of its
+ * package group, which its deploys use too.
+ *
+ * @param  values     Parsed CLI values.
+ * @param  cwd        Repository root with the wp-release config.
+ * @param  name       Package identifier or path under the configured root.
+ * @param  configFile Config file, instead of the conventional one.
+ * @return Source directory, file selection, slug, version and package.
+ * @throws {ValidationError} Without a config or for an unknown package.
+ */
+export async function getPackageSource(values, cwd, name, configFile) {
+    const pkg = await getPackageFiles({
+        cwd,
+        package: name,
+        ...(configFile ? { configFile } : {}),
+    });
+    const source = await describeSource(values, pkg.directory, resolveFileSelection({
+        cwd,
+        sourceDir: pkg.directory,
+        ...pkg.files,
+    }), basename(pkg.directory));
+    return { ...source, package: pkg.name };
+}

package/dist/commands/sign.d.ts

@@ -11,15 +11,6 @@ export interface SignResult {
     /** Public key of the signing key in the form of each signature format. */
     publicKeys: Record<SignatureFormat, string>;
 }
-/**
- * Get the signature formats from the --format values, which can be repeated
- * or comma-separated.
- *
- * @param  values Option values.
- * @return Unique formats, the default when none are given.
- * @throws {ValidationError} If a format is unknown.
- */
-export declare function parseSignatureFormats(values: string[]): SignatureFormat[];
 declare const _default: {
     name: string;
     usage: string;

package/dist/commands/sign.js

@@ -1,30 +1,9 @@
 import { resolve } from 'node:path';
-import { stat } from 'node:fs/promises';
 import { ValidationError } from "../errors.js";
 import { getSignSummary } from "../summary.js";
-import { DEFAULT_SIGNATURE_FORMAT, SIGNATURE_FORMATS, SIGNING_KEY_ENV, getPublicKey, getPublicKeys, isSignatureFormat, parseSigningKey, writeSignature, } from "../signing.js";
+import { SIGNING_KEY_ENV, signFiles } from "../signing.js";
+import { parseSignatureFormats } from "./args.js";
 import { getBoolean, getStrings } from "./command.js";
-/**
- * Get the signature formats from the --format values, which can be repeated
- * or comma-separated.
- *
- * @param  values Option values.
- * @return Unique formats, the default when none are given.
- * @throws {ValidationError} If a format is unknown.
- */
-export function parseSignatureFormats(values) {
-    const names = values
-        .flatMap((value) => value.split(','))
-        .map((name) => name.trim())
-        .filter(Boolean);
-    const unknown = names.filter((name) => !isSignatureFormat(name));
-    if (unknown.length) {
-        throw new ValidationError(`Unknown signature format ${unknown.join(', ')}, use ${Object.keys(SIGNATURE_FORMATS).join(', ')}.`);
-    }
-    return names.length
-        ? [...new Set(names.filter(isSignatureFormat))]
-        : [DEFAULT_SIGNATURE_FORMAT];
-}
 export default {
     name: 'sign',
     usage: 'sign <file>... [options]',
@@ -58,34 +37,18 @@ form of each format.`,
         force: { type: 'boolean' },
     },
     async run({ values, positionals, cwd, logger, }) {
-        const encoded = process.env[SIGNING_KEY_ENV];
         const formats = parseSignatureFormats(getStrings(values, 'format'));
         if (!positionals.length) {
             throw new ValidationError('Pass the files to sign.');
         }
-        if (!encoded?.trim()) {
-            throw new ValidationError(`Set the ${SIGNING_KEY_ENV} environment variable to the base64 Ed25519 signing key.`);
-        }
-        const privateKey = parseSigningKey(encoded);
-        const publicKey = getPublicKey(privateKey);
-        const publicKeys = getPublicKeys(privateKey);
-        const paths = positionals.map((file) => resolve(cwd, file));
-        await Promise.all(paths.map(async (path) => {
-            if (!(await stat(path).catch(() => null))?.isFile()) {
-                throw new ValidationError(`${path} is not a file.`);
-            }
-        }));
-        formats.forEach((format) => logger.debug(`Signing ${format} with the public key ${publicKeys[format]}.`));
-        const signatures = [];
-        const force = getBoolean(values, 'force');
-        const jobs = paths.flatMap((path) => formats.map((format) => ({ path, format })));
-        // Sign in order, so that a failure leaves a predictable set of files.
-        for (const { path, format } of jobs) {
-            const signaturePath = await writeSignature(path, privateKey, force, format);
-            logger.info(signaturePath);
-            signatures.push(signaturePath);
-        }
-        const result = { signatures, formats, publicKey, publicKeys };
+        const signed = await signFiles({
+            paths: positionals.map((file) => resolve(cwd, file)),
+            formats,
+            force: getBoolean(values, 'force'),
+        });
+        formats.forEach((format) => logger.debug(`Signed ${format} with the public key ${signed.publicKeys[format]}.`));
+        signed.signatures.forEach((path) => logger.info(path));
+        const result = { ...signed, formats };
         logger.summary((context) => getSignSummary(context, result));
         return { exitCode: 0, result };
     },

package/dist/commands/verify.d.ts

@@ -12,6 +12,12 @@ declare const _default: {
         checksums: {
             type: "string";
         };
+        'checksums-format': {
+            type: "string";
+        };
+        'checksums-file': {
+            type: "string";
+        };
         zip: {
             type: "string";
         };
@@ -28,6 +34,6 @@ declare const _default: {
             type: "string";
         };
     };
-    run({ values, positionals, cwd, logger }: import("./command.ts").CommandContext): Promise<CommandOutcome<unknown>>;
+    run({ values, positionals, cwd, configFile, logger }: import("./command.ts").CommandContext): Promise<CommandOutcome<unknown>>;
 };
 export default _default;

package/dist/commands/verify.js

@@ -1,8 +1,10 @@
+import { readIntegrity, checkChecksumsFile, resolveManifestCodec, } from "../integrity.js";
+import { loadChangesetConfig } from "../changeset-config.js";
 import { existsSync } from 'node:fs';
 import { mkdir, mkdtemp, readFile, rm } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { basename, isAbsolute, join, posix, resolve } from 'node:path';
-import { readChecksums, verifyChecksums } from "../checksums.js";
+import { verifyChecksums } from "../checksums.js";
 import { downloadFile, isUrl } from "../download.js";
 import { ignoreOwnFile, ignoreOwnSignature, loadFileRules, parseExclude, } from "../file-selection.js";
 import { ValidationError } from "../errors.js";
@@ -105,7 +107,7 @@ function getEmbeddedPath(checksumsPath, embedded) {
             ['.', '..'].includes(path))) {
         throw new ValidationError(`--embedded must be a path inside the plugin with forward slashes, got "${embedded}".`);
     }
-    return embedded || path.endsWith('.json') ? path : null;
+    return path;
 }
 /**
  * Get the manifest and signature pairs to look for inside the checked files.
@@ -180,9 +182,22 @@ async function hasSameContents(original, file) {
  */
 async function checkEmbeddedCopies(input) {
     const { dir, manifest, checksumsPath, embedded, format } = input;
-    const pairs = getCopyPairs(checksumsPath, getEmbeddedPath(checksumsPath, embedded), format);
+    const path = getEmbeddedPath(checksumsPath, embedded);
+    const pairs = getCopyPairs(checksumsPath, path, format).filter((pair) => pair.original !== join(dir, pair.copy) ||
+        existsSync(pair.original));
+    for (const other of Object.keys(SIGNATURE_FORMATS)) {
+        if (other !== format &&
+            path &&
+            existsSync(getSignaturePath(checksumsPath, other))) {
+            pairs.push({
+                original: getSignaturePath(checksumsPath, other),
+                copy: getSignaturePath(path, other),
+            });
+        }
+    }
     if (embedded) {
-        checkExplicitPairs(pairs, manifest);
+        checkExplicitPairs(pairs.filter((pair) => pair.original !== join(dir, pair.copy) ||
+            existsSync(pair.original)), manifest);
     }
     const found = pairs.filter(({ original, copy }) => existsSync(join(dir, copy)) &&
         (embedded ||
@@ -336,8 +351,10 @@ export default {
                           accepted as --source-dir <dir>
 
 Options:
-  --checksums <file>      Checksums manifest from "wp-release checksums" or the
-                          WordPress.org checksums API (required)
+  --checksums-file <file> Relative embedded manifest path (default: checksums.json)
+  --checksums-format <name> wordpress-json or sha256sum; custom codecs via --config
+  --checksums <file>      External checksums manifest from "wp-release checksums" or the
+                          WordPress.org checksums API (optional; otherwise reads embedded manifest)
   --zip <file|url>        Check the files of this ZIP, a local file or an
                           http(s) URL such as the ZIP that WordPress.org
                           builds for a release, instead of <source-dir>
@@ -381,6 +398,8 @@ file that isn't a matching copy is reported as extra. See --embedded for
 where the copies are looked for.`,
     options: {
         checksums: { type: 'string' },
+        'checksums-format': { type: 'string' },
+        'checksums-file': { type: 'string' },
         zip: { type: 'string' },
         'root-folder': { type: 'string' },
         embedded: { type: 'string' },
@@ -389,42 +408,59 @@ where the copies are looked for.`,
         ...sourceDirArgs,
         exclude: { type: 'string', multiple: true },
     },
-    async run({ values, positionals, cwd, logger }) {
+    async run({ values, positionals, cwd, configFile, logger }) {
         const zip = getString(values, 'zip');
         const sourceArg = positionals.length
             ? getSourceDirArg(values, positionals)
             : getString(values, 'source-dir');
         const checksums = getString(values, 'checksums');
-        if (!checksums) {
-            throw new ValidationError('Pass the checksums manifest with --checksums <file>.');
-        }
         if (zip && sourceArg) {
             throw new ValidationError('Pass either --zip or a source directory, not both.');
         }
-        const checksumsPath = resolve(cwd, checksums);
+        // Only load caller-selected configuration, never configuration inside the package.
+        const loaded = configFile
+            ? await loadChangesetConfig({ cwd, configFile })
+            : undefined;
+        const integrity = loaded?.config.integrity;
+        const codec = getString(values, 'checksums-format') ?? integrity?.codec;
+        const file = checkChecksumsFile(getString(values, 'checksums-file') ??
+            integrity?.file ??
+            resolveManifestCodec(codec).filename);
         const publicKey = getString(values, 'public-key');
         const format = getString(values, 'signature-format') ?? DEFAULT_SIGNATURE_FORMAT;
         if (!isSignatureFormat(format)) {
             throw new ValidationError(`Unknown signature format ${format}, use ${Object.keys(SIGNATURE_FORMATS).join(', ')}.`);
         }
-        if (publicKey) {
-            await checkSignature(checksumsPath, publicKey, format);
-            logger.info(`Signature of ${checksumsPath} is valid.`);
-        }
-        const manifest = await readChecksums(checksumsPath);
         const target = await resolveTarget({
             sourceDir: resolve(cwd, sourceArg ?? '.'),
             zip,
             cwd,
             rootFolder: getString(values, 'root-folder'),
         });
+        const checksumsPath = checksums
+            ? resolve(cwd, checksums)
+            : join(target.dir, file);
         try {
+            if (publicKey) {
+                await checkSignature(checksumsPath, publicKey, format);
+                if (!checksums) {
+                    for (const other of Object.keys(SIGNATURE_FORMATS)) {
+                        if (other !== format &&
+                            existsSync(getSignaturePath(checksumsPath, other))) {
+                            await checkSignature(checksumsPath, publicKey, other);
+                        }
+                    }
+                }
+                logger.info(`Signature of ${checksumsPath} is valid.`);
+            }
+            const manifest = await readIntegrity(checksumsPath, codec);
             return await verifyTarget({
                 target,
                 manifest,
                 checksumsPath,
                 exclude: getStrings(values, 'exclude'),
-                embedded: getString(values, 'embedded'),
+                embedded: getString(values, 'embedded') ??
+                    (checksums ? undefined : file),
                 format,
                 logger,
             });

package/dist/commands/zip.d.ts

@@ -8,6 +8,10 @@ export interface ZipResult extends ZipPackageResult {
     version: string | null;
     /** Zipped package, with --package. */
     package?: string;
+    /** External signature paths and package-relative embedded manifest signature paths. */
+    signatures?: string[];
+    /** Base64 public key of the signing key, with ZIP or manifest signing. */
+    publicKey?: string;
 }
 declare const _default: {
     name: string;
@@ -15,15 +19,34 @@ declare const _default: {
     summary: string;
     help: string;
     options: {
-        package: {
+        'checksums-file': {
+            type: "string";
+        };
+        'checksums-format': {
             type: "string";
         };
-        checksums: {
+        'checksums-algorithms': {
+            type: "string";
+            multiple: true;
+        };
+        'embed-checksums': {
+            type: "boolean";
+        };
+        'no-embed-checksums': {
+            type: "boolean";
+        };
+        'no-sign-checksums': {
+            type: "boolean";
+        };
+        sign: {
             type: "boolean";
         };
         force: {
             type: "boolean";
         };
+        package: {
+            type: "string";
+        };
         slug: {
             type: "string";
         };